Capabilities

Zero Trust

Protect mission and business priorities with zero trust

Organizations facing cyber threats are embracing zero trust, a security mindset that protects high-value assets in real time. But cybersecurity teams can’t just buy a zero trust architecture at the store. To put zero trust fully into action, teams need to scrutinize an organization’s strengths and challenges and then chart a path to a zero trust architecture. In this way, organizations can turn core zero trust principles—assume a breach; never trust, always verify; allow only least-privileged access—into concrete solutions that support key missions and strategic objectives.

Click Expand + to view the video transcript

Expand Collapse

Zero Trust is a security strategy where you remove all inherent trust from a network and enforce authorization. In general, there are three main components to zero trust strategy.

First, never trust always verify. Just because someone is in your network, does not mean that you can trust them. Second, implement a least privilege access policy. Grant users and applications the minimum amount of access necessary to do their jobs, and third, assume a breach mindset. Become more proactive and plan for incident response before an attack occurs.

Zero trust is a journey, and you don't have to go it alone. Booz Allen's Zero Trust assessment framework helps determine an organization's maturity level with a focus on protecting its critical assets. Our tailored zero trust architecture that we developed from our experience supporting commercial, defense, and civil agencies, provide a blueprint to achieve the desired security and enterprise visibility.

Finally, we apply a robust governance model to achieve the goals of an organization's Zero Trust strategy. Find out more today.

Common Challenges

Organizations in government and industry must overcome an array of challenges to implement a zero trust architecture. Here are a few examples:

Legacy Infrastructure

A patchwork of cloud environment and legacy IT infrastructure creates many vulnerabilities. In addition, security is often an afterthought in digital modernization efforts.

Data Management

Organizations must figure out how to discover, classify and tag their data before they can enable restricted access based on approved policies.

Identity Management

Getting identity management right is critical for enabling all zero trust principles. In addition, strong authentication and robust attributes are needed to apply conditional access.

Lots and Lots of Logs

Zero trust’s focus on continuous monitoring results in large amount of log collection, which could overwhelm relatively small security teams. Organizations need to handle all that data smartly and efficiently.

Booz Allen’s Approach

Assessment

We show clients how to use the seven pillars of zero trust and governance to elevate security and demonstrate increased maturity step by step with our zero trust maturity assessment model. The model lets organizations rate their capabilities in all seven zero trust dimensions using five maturity levels.

Baselining

The assessment arms organizations with a threat-centric understanding of their strengths and challenges in the context of zero trust, current tools, and capabilities, considering the key missions, strategic priorities, emerging threats, and the organization’s risk appetite.

Zero Trust Architecture Roadmaps

Evaluating the current state of an enterprise's capabilities and gaps allows the security team to weigh priorities and create pillar-specific roadmaps. Not all entities necessarily need to achieve the highest level of maturity in all areas: Every organization is unique.

Tailored Implementation

We help clients craft tailored implementation guidance to achieve measurable improvement over time. For instance, organizations can work toward deploying comprehensive security monitoring, granular dynamic risk-based access controls, and system security automation in a coordinated way throughout the infrastructure.

The 7 Pillars of Zero Trust

The seven zero trust pillars are aligned with the Department of Defense (DOD) zero trust reference architecture and Cybersecurity and Infrastructure Security Agency (CISA) maturity model.

User

Use identity, credential, and access management (e.g., multifactor authentication)

Device

Use real-time inspection, assessment, and patching of devices to inform every access request

Applications & Workloads

Secure application and workload development, access, and operation

Network/Environment

Isolate and control the network environment with segmentation and firewalls

Data

Use end-to-end encryption, data rights management, and data tagging to protect data

Visibility & Analytics

Improve detection and reaction time, enabling real-time access decisions

Automation & Orchestration

Quarantine and/or terminate anomalous activity based on defined processes

Maturity Levels: Elevating Your Security by Design

Our maturity assessment model enables enterprises to focus their improvement step by step, from initial practices toward leading capabilities for each of the seven pillars of zero trust. Click on each of the seven pillars below to learn about the activities associated with each level of maturity.

User

Expand Collapse

Leading: Contextual Access to Device, Network, Apps & Data
Innovative: Granular Access Control
Basic: Privilege Access Management
Minimal: Password Management, Multi-factor authentication, Single Sign On
Initial: Account Discovery & Modeling

Device

Expand Collapse

Leading: Hardware Root of Trust & Host and Runtime integrity
Innovative: C2C/C2R & Conditional Access
Basic: Virtualization Security
Minimal: Asset Baseline
Initial: Asset Discovery & Modeling

Network/Environment

Expand Collapse

Leading: End to End Segmentation
Innovative: Identity Aware Network Micro-segmentation
Basic: Network Micro-segmentation
Minimal: Network Maco-segmentation
Initial: Physical Security Measures & Network Flow Mapping

Applications & Workloads

Expand Collapse

Leading: Process & Container Security
Innovative: Multi-factor Authentication & Attribute Based Access Control (ABAC) Enabled Applications
Basic: Application Micro-segmentation
Minimal: DevSecOps
Initial: Application & Workload Discovery & Modeling

Data

Expand Collapse

Leading: Data Loss Prevention
Innovative: Encryption & Data Rights Management
Basic: Data Tagging/Labeling
Minimal: Data Classification
Initial: Data Discovery & Modeling

Visibility & Analytics

Expand Collapse

Leading: AI/ML-Powered Analytics
Innovative: Threat Intelligence Enrichment
Basic: Unified/Federated SIEM & Traditional Analytics
Minimal: Log Normalization
Initial: Log Identification

Automation & Orchestration

Expand Collapse

Leading: Analytics-Drive SOAR
Innovative: Basic SOAR
Basic: Task & Workflow Automation
Minimal: Non-Security A&O
Initial: Defined Security Processes

Building Mission-Driven 5G Security with

Zero Trust

National security missions must overcome risks around untrusted technology in a hyperconnected world. To shield sensitive data through these challenges, the Department of Defense is urging its senior leaders, engineers, and operators, to embrace a “zero trust” security mindset.

Learn More

4 Steps to Securing Critical Data

Moving to a zero trust architecture can be overwhelming for organizations. They must not only assess their current cybersecurity posture but also determine where and when to modernize the infrastructure and capabilities to best secure their critical data. Booz Allen recommends the following four-step approach to identifying and deploying new cybersecurity solutions to move to a zero trust architecture:

1. Diagnose

Identify current IT capabilities and roadmaps covering the zero trust focus areas described by DOD, NSA, CISA, and the National Institute of Standards and Technology (NIST). Conduct a zero trust maturity assessment across the seven pillars to obtain objective insights into your organization’s strengths and improvement areas.

3. Develop

Test new configurations, integrations, and solutions in a lab environment. Conduct proof-of-concept trials of new technologies with a limited user set and develop migration and implementation plans.

2. Design

Create a zero trust strategy, identifying solutions to close critical gaps identified during the diagnose phase. The overarching strategy spans the zero trust pillars, provides a unified target state and a multiyear roadmap, and prioritizes the development of strong governance policies that drive enforcement of conditional access.

4. Deploy

Reconfigure existing systems using validated implementation plans. Install and integrate new solutions to close capability gaps. Migrate users to new solutions and conduct continuous monitoring.

How to Design and Develop Your Zero Trust Program

Understanding your organization’s position on the zero trust spectrum empowers you to set targets and implement solutions that drive down operational risk. Download the factsheet below to learn how maturity assessment frameworks can strengthen your zero trust architecture.

Zero Trust in the Cloud

Adoption of hybrid and multi-cloud environments help organizations modernize but also increases the attack surface that an organization now must need to protect. We work with leading cloud service providers to provide clients the zero trust solutions they need to achieve mission objectives. This includes implementing secure remote conditional access solutions, using federated identify to verify user information, and deploying solutions that provide continuous risk monitoring through prevention, detection, response, and prediction.

Experts in the Field

Kelly Rozumalski

Imran Umar

Jack Gomes

Frequently Asked Questions

What are the principles of zero trust?

Expand Collapse

There are three principles of zero trust: assume a breach; never trust, always
verify; and allow only least-privileged access based on contextual factors.

What is zero trust about?

Expand Collapse

Embracing zero trust is about stepping up and owning the risk that threats can emerge inside, not just outside, traditional network boundaries—and it’s about proactively countering these risks.

Are there deadlines for implementing zero trust?

Expand Collapse

Yes. Based on Executive Order 14028 and the federal zero trust strategy, agencies must achieve specific zero trust security objectives by the end of fiscal year 2024.

First Name*

Last Name*

Email Address*

Company*

Title*

Country*

Would you like to receive occasional email updates from Booz Allen Hamilton?

Comment or Question

address1

Zero Trust